CrazyTB's blog

Trying it out

Go to Google Maps and click on the little button right above the street-view icon (right above the zoom slider). The browser will ask permission before giving geolocation information to the site. Then your location is magically marked on Google Maps.

How the hell does it know my location?

Researching...

Looking at Geolocation API Network Protocol, I see that information about nearby Wi-Fi and cellphone towers is sent to the geolocation service provider, which will return a location based on such info. Since this is a notebook and it has no cellphone connectivity, I suppose the only available info is about Wi-Fi access points.

But... Wait! Does the browser (or even the web application) have access to available Wi-Fi networks? It's weird, it's scaring, but the answer is: yes!. If you go to test-geolocation with a Gears-enabled browser, you will see that the webpage can grab information about available Wi-Fi access points.

Anyway, the geolocation API uses the Wi-Fi access points behind the scenes. If the web application uses the geolocation API, it receives just the coordinates. All the details about how those coordinates are calculated are completely hidden from the end-user (or the application).

So... If it uses Wi-Fi to find out the location, what happens if I disable Wi-Fi on my notebook and connect to the Internet using the good old ethernet cable? Testing... Hmm... It doesn't know anymore where I am!

My next step is to find out what service it uses for resolving the location, based on Wi-Fi networks. I've written a simple geolocation JavaScript for test purposes. Actually, I copied the code from another example and cut away all extra parts. This code is available at the Simple geolocation experiment page. It only works on Firefox, but that's enough for my tests.

Now I open Wireshark and start capturing packets. Then I click on "Find me!" on that test page. Now I go back to Wireshark and start to analyze the packets... Damn it! The data is sent over a secure connection (HTTPS)! I can't read the contents! Time for more research...

After a little while, I found something interesting. Obviously, the URL for the geolocation resolver is not hard-coded inside the browser: it is available at about:config in Firefox. Just look for geo.wifi.uri.

Time for more experiments... The default value for geo.wifi.uri is https://www.google.com/loc/json. Let me change that https to http and try again, while capturing packets using Wireshark... Success!

Conclusions

The browser sends a POST request with a very simple JSON, containing just two properties: "version":"1.1.0" and "wifi_towers". The list of Wi-Fi access points sends the following details about them: "mac_address", "ssid" and "signal_strength". In my case, two access points were sent.

The response is also in JSON format, containing two properties: "location" and "access_token". The location itself is composed of three properties: "latitude", "longitude" and "accuracy".

Update 2010-02-19: An anonymous user shared the link to the Google Geolocation API Network Protocol.

There are only two Wi-Fi networks here, one is my own ad-hoc network and the other one is probably from some neighbor (who is probably called "Walter"). Thus, I wanted to find out if Google knows about the location of my Wi-Fi (which would be insanely scary) or it only knows about "Walter Wi-Fi Network". For this purpose, I wrote a simple Python script:

import sys
import urllib2

url = "https://www.google.com/loc/json"
data = """INSERT YOUR JSON DATA HERE""

output = urllib2.urlopen(url, data).read()
sys.stdout.write(output)

In data, I pasted the exact JSON that Firefox sends to Google, but removed my Wi-Fi from that list (leaving only the neighbor's Wi-Fi on that list). After running the script, I got the same response that I got in Firefox. This means that Google knows exactly where "Walter Wi-Fi Network" is located. Then, I removed the neighbor's network and put my own network back. What happened? I got an empty JSON response. This means Google does not know about my network... yet?

But the question remains: how the hell does Google know the exact geolocation of my neighbor's Wi-Fi?